Tunneling IPv6: ISATAP Tunnels

VN:F [1.9.6_1107]
Rating: 4.5/5 (2 votes cast)
By Marko Milivojevic on September 8th, 2010

In this second article in IPv6 tunneling series, I will focus my attention on another one of the automatic tunneling modes. Today, we will examine Intra-Site Automatic Tunnel Addressing Protocol – ISATAP.

Not unlike automatic 6to4 tunnels, which I blogged about last time, ISATAP tunnels automatically send traffic to its IPv6 destination over the underlying IPv4 network on a packet-by-packet basis. There are some important differences between ISATAP and 6to4 tunnels. Understanding those differences is very important.

To explore this interesting technology a bit deeper, let’s use the diagram below. Those of you with sharp eyes will notice this network is very similar to the one I used for 6to4 tunnels. In fact, it’s nearly identical.

Diagram

Network configuration is relatively simple. We have IPv4 backbone network, represented by the BB device. This can be any number of routers, or protocols, but one will be more than enough. Next, we have three IPv6 “islands” – sites “A”, “B” and “C”, with their respective border routers. Border routers are connected to IPv4 backbone and run EIGRP 235 as the routing protocol. They have full reachability. The goal is to provide full reachability between IPv6 islands – more specifically networks hanging off the Ethernet0/0 interfaces of routers R1, R4 and R6.

Initial IPv4 Configuration

Here is the very quick overview of relevant IPv4 information about this network.

R2: 

R2#show ip route eigrp | begin Gateway
Gateway of last resort is not set

      3.0.0.0/32 is subnetted, 1 subnets
D        3.3.3.3 [90/2809856] via 192.168.2.7, 00:01:15, Serial1/1
      5.0.0.0/32 is subnetted, 1 subnets
D        5.5.5.5 [90/2809856] via 192.168.2.7, 00:01:13, Serial1/1
D     192.168.3.0/24 [90/2681856] via 192.168.2.7, 00:01:18, Serial1/1
D     192.168.5.0/24 [90/2681856] via 192.168.2.7, 00:01:15, Serial1/1

R2#ping 3.3.3.3 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/19/28 ms
R2#ping 5.5.5.5 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/32 ms

R3 

R3#show ip route eigrp | begin Gateway
Gateway of last resort is not set

      2.0.0.0/32 is subnetted, 1 subnets
D        2.2.2.2 [90/2809856] via 192.168.3.7, 00:02:39, Serial1/0
      5.0.0.0/32 is subnetted, 1 subnets
D        5.5.5.5 [90/2809856] via 192.168.3.7, 00:02:35, Serial1/0
D     192.168.2.0/24 [90/2681856] via 192.168.3.7, 00:02:37, Serial1/0
D     192.168.5.0/24 [90/2681856] via 192.168.3.7, 00:02:37, Serial1/0

R3#ping 2.2.2.2 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 3.3.3.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/17/20 ms
R3#ping 5.5.5.5 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
Packet sent with a source address of 3.3.3.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/17/20 ms

R5: 

R5#show ip route eigrp | begin Gateway
Gateway of last resort is not set

      2.0.0.0/32 is subnetted, 1 subnets
D        2.2.2.2 [90/2809856] via 192.168.5.7, 00:03:40, Serial1/2
      3.0.0.0/32 is subnetted, 1 subnets
D        3.3.3.3 [90/2809856] via 192.168.5.7, 00:03:40, Serial1/2
D     192.168.2.0/24 [90/2681856] via 192.168.5.7, 00:03:40, Serial1/2
D     192.168.3.0/24 [90/2681856] via 192.168.5.7, 00:03:40, Serial1/2

R5#ping 2.2.2.2 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/16/20 ms
R5#ping 3.3.3.3 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/18/24 ms

We can see that our edge routers have full reachability between their Loopback0 interfaces. We will need that for tunnels.

Initial IPv6 Configuration

Of course, we also have some IPv6 configuration in place. Notably, all three sites are fully operational and have OSPFv3 routing in place. Let’s take a look at that, starting with Site “A”.

R2: 

R2#show ipv6 route | begin ^(L|O)
O   2001:DB8::1/128 [110/64]
     via FE80::1, Serial1/0
LC  2001:DB8::2/128 [0/0]
     via Loopback0, receive
O   2001:DB8:1::/64 [110/74]
     via FE80::1, Serial1/0
C   2001:DB8:12::/64 [0/0]
     via Serial1/0, directly connected
L   2001:DB8:12::2/128 [0/0]
     via Serial1/0, receive
L   FF00::/8 [0/0]
     via Null0, receive

R2#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
1.1.1.1           0   FULL/  -        00:00:34    7               Serial1/0

R2#ping 2001:db8::1 source Loopback0 

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8::1, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/12 ms
R2#ping 2001:db8:1::1 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:1::1, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/10/16 ms

Next, let’s take a look at Site “B”:

R3: 

R3#show ipv6 route | begin ^(L|O)
LC  2001:DB8::3/128 [0/0]
     via Loopback0, receive
O   2001:DB8::4/128 [110/64]
     via FE80::4, Serial1/1
O   2001:DB8:4::/64 [110/74]
     via FE80::4, Serial1/1
C   2001:DB8:34::/64 [0/0]
     via Serial1/1, directly connected
L   2001:DB8:34::3/128 [0/0]
     via Serial1/1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R3#ping 2001:db8::4 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8::4, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/10/20 ms
R3#ping 2001:db8:4::4 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:4::4, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/16 ms

Finally, Site “C”:

R5: 

R5#show ipv6 route | begin ^(L|O)
LC  2001:DB8::5/128 [0/0]
     via Loopback0, receive
O   2001:DB8::6/128 [110/64]
     via FE80::6, Serial1/0
O   2001:DB8:6::/64 [110/74]
     via FE80::6, Serial1/0
C   2001:DB8:56::/64 [0/0]
     via Serial1/0, directly connected
L   2001:DB8:56::5/128 [0/0]
     via Serial1/0, receive
C   2001:DB8:235::/64 [0/0]
     via Tunnel0, directly connected
L   2001:DB8:235::5EFE:505:505/128 [0/0]
     via Tunnel0, receive
L   FF00::/8 [0/0]
     via Null0, receive

R5#ping 2001:db8::6 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8::6, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::5
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/12 ms
R5#ping 2001:db8:6::6 source Loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:6::6, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8::5
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/16 ms

Excellent! Everything works, just as we need it. Let’s now make our network work, end-to-end.

Connecting the Islands Using ISATAP Tunnels

The first thing we should notice as the difference when comparing this network to 6to4 tunnels is the lack of restriction on address space. I used 2001:DB8::/32 range, because that’s what I’m supposed to use when writing documentation, but I could’v used just about any valid IPv6 addresses. With 6to4 tunnels, each site is restricted to using address space that is related to the “edge tunnel’s IPv4 interface”. It’s this restriction that makes 6to4 tunnels appealing and popular globally.

ISATAP tunnels are intended to solve a little bit different problem. ISATAP tunnels will traverse underlying IPv4 network and allow IPv6 sites to communicate with each other, but they will not “autoroute” anything behind the actual Tunnel interface. ISATAP tunnels create virtual NBMA segment to which all tunnel interfaces are connected to and can communicate with each other. Let me show you the configuration and I can explain as I go.

R2: 

interface Tunnel0
 no ip address
 ipv6 address 2001:DB8:235::/64 eui-64
 tunnel source Loopback0
 tunnel mode ipv6ip isatap
!
R2#show ipv6 interface Tunnel0
Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::5EFE:202:202
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:235::5EFE:202:202, subnet is 2001:DB8:235::/64 [EUI]
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF02:202
  MTU is 1480 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is not supported
  ND reachable time is 30000 milliseconds (using 32656)
  Hosts use stateless autoconfig for addresses.

R3: 

interface Tunnel0
 no ip address
 ipv6 address 2001:DB8:235::/64 eui-64
 tunnel source Loopback0
 tunnel mode ipv6ip isatap
!
R3#show ipv6 interface Tunnel0
Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::5EFE:303:303
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:235::5EFE:303:303, subnet is 2001:DB8:235::/64 [EUI]
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF03:303
  MTU is 1480 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is not supported
  ND reachable time is 30000 milliseconds (using 44203)
  Hosts use stateless autoconfig for addresses.

R5: 

interface Tunnel0
 no ip address
 ipv6 address 2001:DB8:235::/64 eui-64
 tunnel source Loopback0
 tunnel mode ipv6ip isatap
!
R5#show ipv6 interface Tunnel0
Tunnel0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::5EFE:505:505
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:235::5EFE:505:505, subnet is 2001:DB8:235::/64 [EUI]
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF05:505
  MTU is 1480 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is not supported
  ND reachable time is 30000 milliseconds (using 22169)
  Hosts use stateless autoconfig for addresses.

There are couple of important points we need to pick up from the above output. First of all, tunnel configurations are initially identical on R2, R3 and R5. We don’t have tunnel destination, but we have tunnel source. Also, IPv6 address is determined using EUI-64 mechanism. More correctly, we instructed the router to do so, however when we take a look at the resulting address, we can see that it doesn’t conform to those rules. What we can observe is that 64-bit prefix (2001:DB8:235:/64) is followed by 0000:5EFE and then followed by 32-bits representing the IP address of the source interface. On R2, this is 2.2.2.2, which results in 0202:0202 (202:202 with omitted zeroes). This is the direct result of the ISATAP. Tunnel interfaces configured for ISATAP will use modified to configure IPv6 addresses. We can see this on R2, R3 and R5.

Next, let’s see if our tunnels work. We should be able to ping between R2, R3 and R5.

R2: 

R2#ping 2001:DB8:235::5EFE:202:202

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:202:202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R2#ping 2001:DB8:235::5EFE:303:303

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:303:303, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/32 ms
R2#ping 2001:DB8:235::5EFE:505:505

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:505:505, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/16/20 ms

R3: 

R3#ping 2001:DB8:235::5EFE:202:202

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:202:202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/19/24 ms
R3#ping 2001:DB8:235::5EFE:303:303

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:303:303, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3#ping 2001:DB8:235::5EFE:505:505

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:505:505, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/17/20 ms

R5: 

R5#ping 2001:DB8:235::5EFE:202:202

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:202:202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/21/36 ms
R5#ping 2001:DB8:235::5EFE:303:303

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:303:303, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/19/28 ms
R5#ping 2001:DB8:235::5EFE:505:505

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:235::5EFE:505:505, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/4/8 ms

We are not done however. If we examine any of our routers’ IPv6 routing tables, we’ll see that they have no idea about any other islands, still. All we have is new interface connecting edge routers. Let’s examine R2 and R1 to observe this.

R2: 

R2#show ipv6 route | begin ^(L|O)
O   2001:DB8::1/128 [110/64]
     via FE80::1, Serial1/0
LC  2001:DB8::2/128 [0/0]
     via Loopback0, receive
O   2001:DB8:1::/64 [110/74]
     via FE80::1, Serial1/0
C   2001:DB8:12::/64 [0/0]
     via Serial1/0, directly connected
L   2001:DB8:12::2/128 [0/0]
     via Serial1/0, receive
C   2001:DB8:235::/64 [0/0]
     via Tunnel0, directly connected
L   2001:DB8:235::5EFE:202:202/128 [0/0]
     via Tunnel0, receive
L   FF00::/8 [0/0]
     via Null0, receive

R1: 

R1#show ipv6 route | begin ^(L|O)
LC  2001:DB8::1/128 [0/0]
     via Loopback0, receive
O   2001:DB8::2/128 [110/64]
     via FE80::2, Serial1/0
C   2001:DB8:1::/64 [0/0]
     via Ethernet0/0, directly connected
L   2001:DB8:1::1/128 [0/0]
     via Ethernet0/0, receive
C   2001:DB8:12::/64 [0/0]
     via Serial1/0, directly connected
L   2001:DB8:12::1/128 [0/0]
     via Serial1/0, receive
L   FF00::/8 [0/0]
     via Null0, receive

We need to handle this. To do that, we need to configure routing over the tunnel.

IPv6 Routing Over the Tunnels

Configuring routing over the tunnel may look like an easy task to begin with, but before we judge it so, let’s examine what just happened. We now have virtual NBMA network between R1, R2 and R3. We are running OSPFv3 as the routing protocol. What do we know about OSPF and NBMA networks – that we need to specify neighbors as there is no “broadcast” functionality. Furthermore, Tunnel interfaces are treated as point-to-point by OSPF, so we have to take care of that. Last but not the least, neighbors in OSPFv3 are specified using link-local and not global addresses. To speed things up, I’ve slightly lowered hello-interval Here’s the configuration.

R2: 

interface Tunnel0
 ipv6 ospf network non-broadcast
 ipv6 ospf neighbor FE80::5EFE:303:303
 ipv6 ospf neighbor FE80::5EFE:505:505
 ipv6 ospf hello-interval 5
 ipv6 ospf 1 area 0
!

R3: 

interface Tunnel0
 ipv6 ospf network non-broadcast
 ipv6 ospf neighbor FE80::5EFE:202:202
 ipv6 ospf neighbor FE80::5EFE:505:505
 ipv6 ospf hello-interval 5
 ipv6 ospf 1 area 0
!

R4: 

interface Tunnel0
 ipv6 ospf network non-broadcast
 ipv6 ospf neighbor FE80::5EFE:303:303
 ipv6 ospf neighbor FE80::5EFE:202:202
 ipv6 ospf hello-interval 5
 ipv6 ospf 1 area 0
!

Let’s verify the reachability now.

R1: 

R1#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
2.2.2.2           0   FULL/  -        00:00:36    7               Serial1/0
R1#show ipv6 route ospf | begin ^O
O   2001:DB8::2/128 [110/64]
     via FE80::2, Serial1/0
O   2001:DB8::3/128 [110/1064]
     via FE80::2, Serial1/0
O   2001:DB8::4/128 [110/1128]
     via FE80::2, Serial1/0
O   2001:DB8::5/128 [110/1064]
     via FE80::2, Serial1/0
O   2001:DB8::6/128 [110/1128]
     via FE80::2, Serial1/0
O   2001:DB8:4::/64 [110/1138]
     via FE80::2, Serial1/0
O   2001:DB8:6::/64 [110/1138]
     via FE80::2, Serial1/0
O   2001:DB8:34::/64 [110/1128]
     via FE80::2, Serial1/0
O   2001:DB8:56::/64 [110/1128]
     via FE80::2, Serial1/0
O   2001:DB8:235::/64 [110/1064]
     via FE80::2, Serial1/0

R2: 

R2#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
5.5.5.5           1   FULL/DROTHER    00:00:19    13              Tunnel0
3.3.3.3           1   FULL/BDR        00:00:18    13              Tunnel0
1.1.1.1           0   FULL/  -        00:00:39    7               Serial1/0
R2#show ipv6 route ospf | begin ^O
O   2001:DB8::1/128 [110/64]
     via FE80::1, Serial1/0
O   2001:DB8::3/128 [110/1000]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8::4/128 [110/1064]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8::5/128 [110/1000]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8::6/128 [110/1064]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8:1::/64 [110/74]
     via FE80::1, Serial1/0
O   2001:DB8:4::/64 [110/1074]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8:6::/64 [110/1074]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8:34::/64 [110/1064]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8:56::/64 [110/1064]
     via FE80::5EFE:505:505, Tunnel0

R3: 

R3#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
5.5.5.5           1   FULL/DROTHER    00:00:19    13              Tunnel0
2.2.2.2           1   FULL/DR         00:00:18    13              Tunnel0
4.4.4.4           0   FULL/  -        00:00:35    8               Serial1/1
R3#show ipv6 route ospf | begin ^O
O   2001:DB8::1/128 [110/1064]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8::2/128 [110/1000]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8::4/128 [110/64]
     via FE80::4, Serial1/1
O   2001:DB8::5/128 [110/1000]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8::6/128 [110/1064]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8:1::/64 [110/1074]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8:4::/64 [110/74]
     via FE80::4, Serial1/1
O   2001:DB8:6::/64 [110/1074]
     via FE80::5EFE:505:505, Tunnel0
O   2001:DB8:12::/64 [110/1064]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8:56::/64 [110/1064]
     via FE80::5EFE:505:505, Tunnel0

R4: 

R4#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
3.3.3.3           0   FULL/  -        00:00:36    8               Serial1/1
R4#show ipv6 route ospf | begin ^O
O   2001:DB8::1/128 [110/1128]
     via FE80::3, Serial1/1
O   2001:DB8::2/128 [110/1064]
     via FE80::3, Serial1/1
O   2001:DB8::3/128 [110/64]
     via FE80::3, Serial1/1
O   2001:DB8::5/128 [110/1064]
     via FE80::3, Serial1/1
O   2001:DB8::6/128 [110/1128]
     via FE80::3, Serial1/1
O   2001:DB8:1::/64 [110/1138]
     via FE80::3, Serial1/1
O   2001:DB8:6::/64 [110/1138]
     via FE80::3, Serial1/1
O   2001:DB8:12::/64 [110/1128]
     via FE80::3, Serial1/1
O   2001:DB8:56::/64 [110/1128]
     via FE80::3, Serial1/1
O   2001:DB8:235::/64 [110/1064]
     via FE80::3, Serial1/1

R5: 

R5#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
2.2.2.2           1   FULL/DR         00:00:18    13              Tunnel0
3.3.3.3           1   FULL/BDR        00:00:18    13              Tunnel0
6.6.6.6           0   FULL/  -        00:00:39    7               Serial1/0
R5#show ipv6 route ospf | begin ^O
O   2001:DB8::1/128 [110/1064]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8::2/128 [110/1000]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8::3/128 [110/1000]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8::4/128 [110/1064]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8::6/128 [110/64]
     via FE80::6, Serial1/0
O   2001:DB8:1::/64 [110/1074]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8:4::/64 [110/1074]
     via FE80::5EFE:303:303, Tunnel0
O   2001:DB8:6::/64 [110/74]
     via FE80::6, Serial1/0
O   2001:DB8:12::/64 [110/1064]
     via FE80::5EFE:202:202, Tunnel0
O   2001:DB8:34::/64 [110/1064]
     via FE80::5EFE:303:303, Tunnel0

R6: 

R6#show ipv6 ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
5.5.5.5           0   FULL/  -        00:00:31    7               Serial1/0
R6#show ipv6 route ospf | begin ^O
O   2001:DB8::1/128 [110/1128]
     via FE80::5, Serial1/0
O   2001:DB8::2/128 [110/1064]
     via FE80::5, Serial1/0
O   2001:DB8::3/128 [110/1064]
     via FE80::5, Serial1/0
O   2001:DB8::4/128 [110/1128]
     via FE80::5, Serial1/0
O   2001:DB8::5/128 [110/64]
     via FE80::5, Serial1/0
O   2001:DB8:1::/64 [110/1138]
     via FE80::5, Serial1/0
O   2001:DB8:4::/64 [110/1138]
     via FE80::5, Serial1/0
O   2001:DB8:12::/64 [110/1128]
     via FE80::5, Serial1/0
O   2001:DB8:34::/64 [110/1128]
     via FE80::5, Serial1/0
O   2001:DB8:235::/64 [110/1064]
     via FE80::5, Serial1/0

It looks like we have all the routes. Let’s now run the full reachability test, using well-known TCL script:

foreach mip {
 2001:DB8::1
 2001:DB8::2
 2001:DB8::3
 2001:DB8::4
 2001:DB8::5
 2001:DB8::6
 2001:DB8:1::1
 2001:DB8:4::4
 2001:DB8:6::6
 2001:DB8:12::1
 2001:DB8:12::2
 2001:DB8:34::3
 2001:DB8:34::4
 2001:DB8:56::5
 2001:DB8:56::6
 2001:DB8:235::5EFE:202:202
 2001:DB8:235::5EFE:303:303
 2001:DB8:235::5EFE:505:505
} { ping $mip source Loopback0 repeat 3 timeout 1 }

I’ll show just the output from R1, but it should work from all routers equally well.

R1: 

R1#tclsh
R1(tcl)#foreach mip {
+>(tcl)# 2001:DB8::1
+>(tcl)# 2001:DB8::2
+>(tcl)# 2001:DB8::3
+>(tcl)# 2001:DB8::4
+>(tcl)# 2001:DB8::5
+>(tcl)# 2001:DB8::6
+>(tcl)# 2001:DB8:1::1
+>(tcl)# 2001:DB8:4::4
+>(tcl)# 2001:DB8:6::6
+>(tcl)# 2001:DB8:12::1
+>(tcl)# 2001:DB8:12::2
+>(tcl)# 2001:DB8:34::3
+>(tcl)# 2001:DB8:34::4
+>(tcl)# 2001:DB8:56::5
+>(tcl)# 2001:DB8:56::6
+>(tcl)# 2001:DB8:235::5EFE:202:202
+>(tcl)# 2001:DB8:235::5EFE:303:303
+>(tcl)# 2001:DB8:235::5EFE:505:505
+>(tcl)#} { ping $mip source Loopback0 repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::1, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 4/5/8 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::2, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/10/12 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::3, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::4, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/34/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::5, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/30/40 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8::6, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/34/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:1::1, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:4::4, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/33/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:6::6, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/33/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:12::1, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:12::2, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/9/12 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:34::3, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/26/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:34::4, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/34/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:56::5, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/26/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:56::6, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/34/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:235::5EFE:202:202, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/9/12 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:235::5EFE:303:303, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2001:DB8:235::5EFE:505:505, timeout is 1 seconds:
Packet sent with a source address of 2001:DB8::1
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/28/32 ms

Happy studies!

–
Marko Milivojevic – CCIE #18427
Senior Technical Instructor – IPexpert
Join our Online Study List

Tunneling IPv6: ISATAP Tunnels, 4.5 out of 5 based on 2 ratings
Share and Enjoy:
  • RSS
  • Twitter
  • Facebook
  • Google Bookmarks
  • Digg
  • Print
  • Technorati
  • Slashdot
  • LinkedIn
  • del.icio.us
  • Reddit
  • Sphinn
  • Mixx
  • Blogplay
  • Netvibes
  • NewsVine
  • Live
  • Ping.fm
  • MySpace
  • Yahoo! Bookmarks
  • Yahoo! Buzz

Tags: , , ,

This entry was posted on Wednesday, September 8th, 2010 at 8:02 am and is filed under CCIE, Routing & Switching. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

4 Responses to “Tunneling IPv6: ISATAP Tunnels”

  1. bertrand says:
    February 23, 2011 at 6:12 pm

    I have the same configuration But I am not able each tunnel after configuring the tunnel. Am I missing something?
    From all r2, r5, r3 the tunnel are up. But cannot ping each other. Do you need to configure something on BB router beside the ip4 and eigrp?

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
    Reply
  2. bertrand says:
    February 23, 2011 at 6:18 pm

    Connecting the Islands Using ISATAP Tunnels
    After configuring the tunnels, I am not able to ping r3, or r5 tunnel. I checked the ipv6 addresses and the configuration on all my tunnels- they are identical to your configuration.
    Why I can’t ping the tunnel as you did on Connecting the island step?

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
    Reply
  3. bertrand says:
    February 23, 2011 at 7:15 pm

    Sorry, It is working now. I don’t what was the problem. may be there some kinds of delay. All I did was to change the tunnel source from lo 0 to fa0/0 and then back to lo 0 on all 3 routers.
    Now with all tunnel source lo 0, i can ping all tunnels from any site.

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
    Reply
  4. daniel white says:
    July 21, 2011 at 10:30 pm

    Hi All,
    Finding supporting documentation for ISATAP inter-site connectivity is very scarce on the NET. I have labbed it up and do not see any issues with connecting CE-to-CE formation with BGP/OSPF adjacencies and routing over tunnel…but no one recommends using ISATAP for inter-site connectivity with no good reasoning why.
    Does anybody have any good links or nuggets??
    ..thanks daniel

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
    Reply

Leave a Reply